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Abstract 



The claw finding problem has been studied in terms of query complexity as one of the problems closely 
connected to cryptography. For given two functions, / and g, as an oracle which have domains of size 
and M {N < M), respectively, and the same range, the goal of the problem is to find x and y such that 
f(x) - g(y). This problem has been considered in both quantum and classical settings in terms of query 
complexity. This paper describes an optimal algorithm using quantum walk that solves this problem. Our 
algorithm can be slightly modified to solve a more general problem of finding a tuple consisting of elements 
in the two function domains that has prespecified property. Our algorithm can also be generaUzed to find a 
■ claw of k functions for any constant integer k > I, where the domains of the functions may have different 

^ I size. Keywords: quantum computing, query complexity, oracle computation 



(Sj ! 1 Introduction 

^ . The most significant discovery in quantum computation would be Shor's polynomial-time quantum algorithms 
ly-^ \ for factoring integers and computing discrete logarithms 1 15|, both of which are believed to be hard to solve 
CN ' in classical settings and are thus used in arguments for the security of the widely used cryptosystems. Another 
00 ■ significant discovery is Grover's quantum algorithm for the problem of searching an unstructured set ifTTl . i.e, 
O \ the problem of searching for / € {0, 1, ... - 1} such that /(/) = 1 for a hidden Boolean function /; it has 
yielded a variety of generalizations ||4j[12l|2j[l6l|T3|. Grover's algorithm and its generalizations assume the 
oracle computation model, in which a problem instance is given as a black box (called an oracle) and any 
algorithm needs to make queries to the black box to get sufficient information on the instance. In the case of 
^ \ searching an unstructured set, any algorithm needs to make queries of the form "what is the value of function 
■ /for input / ?" to the given oracle. In the oracle computation model, the efficiency of an algorithm is usually 
measured by the number of queries the algorithm needs to make, i.e., the query complexity of the algorithm. 
The query complexity of a problem means the query complexity of the algorithm that solves the problem with 
fewest queries. 

One of the earliest applications of Grover's algorithm was the bounded-error algorithm of Brassard, H0yer 
and Tapp iH; it addressed the collision problem in a cryptographic context, i.e., finding pair {x,y) such that 
/(x) - f(y), in a given 2-to-l function / of domain size N. Their quantum algorithm requires 0{N^^^) queries, 
whereas any bounded-error classical algorithm needs @{N^^^) queries. Subsequently, Aaronson and Shi [1] 
proved the matching lower bound. Brassard et al. f5\ considered two more related problems: the element 
distinctness problem and the claw finding problem. These problems are also important in a cryptographic sense. 
Furthermore, studying these problems has deepened our understanding of the power of quantum computation. 

The element distinctness problem is to decide whether or not N integers given as an oracle are all distinct. 
Buhrman et al. ||8j| gave a bounded-error algorithm for the problem, which makes OiN^^"^) queries (strictly 
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speaking, they assumed a comparison oracle, which returns just the result of comparing function values for two 
specified inputs, and, in this case, the query complexity is 0{N^^'^ log N)). Subsequently, Ambainis |2 | gave an 
improved upper bound 0{N^^^) by introducing a new framework of quantum walk (his quantum walk algorithm 
was reviewed from a slightly more general point of view in fTT.TOl, and a much more general framework was 
given by Szegedy [16]). This upper bound matches the lower bound proved by Aaronson and Shi [1]. 

The claw finding problem is defined as follows. Given two functions f : X ^ Z and ^ : 7 ^ Z as an oracle, 
decide whether or not there exists at least one pair {x,y) eXxY, called a claw, such that f{x) - giy), and find 
a claw if it exists, where X and Y are domains of size N and M (N < M), respectively. By clawfinding W M), we 
mean this problem. 

After Brassard et al. Q considered a special case of the claw finding problem, Buhrman et al. Q gave 
a quantum algorithm that requires 0(N^^^M^^'^) queries fov N < M < and 0{M^I^) queries for M > 
(strictly speaking, they assumed a comparison oracle, and, in this case, the query complexity is multiplied by 
logN). They also proved that any algorithm requires Q(M^^^) queries by reducing the search problem over an 
unstructured set to the claw finding problem. Thus, while their bounds of the query complexity are tight when 
M > N^, there is still a big gap when N < M < N^. Furthermore, they considered the case of k functions, 
i.e., the k-claw finding problem defined as follows: given k functions f, : X,- := {1, . . . ,A^,} Z (i e {I, . . . ,k}) 
as an oracle, where k > I is any constant integer, and A^,- < Nj if / < j, decide whether or not there exists 
at least one fc-claw, i.e., a tuple {x\,. . .,Xk) € X\ x ■ ■ ■ x X^ such that fiixi) = fjixj) for any /, 7 € {1, ... , k}, 
and find a k-claw if it exists. A generalization of their algorithm works well for the ^-claw finding problem; 
its query complexity is OiN^"^^^ ) if A^,- - N for all /€{!,... ,k}. It is shown in [141 that the quantum-walk 
algorithm in [2J for the element distinctness problem is general enought to be applied with slight modification 
to the k-claw finding problem; this yields query complexity 0{(^^^^Ni)M) if the promise is assumed that 

1 k 

there is at most one solution, and, with random reduction, query complexity 0((2i*Li Nj)M) for the problem 
without the single-solution promise. Zhang ifTTl generalized the quantum-walk algorithm in m to solve the 
claw finding problem with the single-solution promise by making 0{{NMy^^) queries for N < M < and 
0{M^^'^) for M > N^. This upper bound is optimal, since the matching lower bound Q.{{NMy/^) was proved in 
the paper by reducing the collision problem to the claw finding problem. Zhang also showed that the algorithm 
can be generalized to solve a more general problem of finding a tuple consisting of elements in the domains of 
given k functions with the single-solution promise. To solve the problems without the promise, we usually use 
a randomly reduction to the problem with the single-solution promise, which is known to increase the query 
complexity by at most a log factor as pointed out in lfT4]| (if the problem has certain robust properties, there is 
a random reduction that increases the query complexity by a constant multiplicative factor, e.g., 13.) 

This paper gives an optimal quantum algorithm that directly (i.e., without using such a random reduction) 
solves the claw finding problem without the single-solution promise. The query complexity of our algorithm is 
as follows: 



where Q{P) means the number of queries required to solve problem P with one-sided bounded error (i.e., 
with the one-sided error probability bounded by a certain constant, say, 1/3). The optimality is guaran- 
teed by the lower bounds given in 171 [17]. Our algorithm can be modified to solve a more general prob- 
lem of finding a tuple {x\, . . . ,Xp,y\, . . . ,yq) e X'^ x such that xi + xj and yi 4^ yj for any / j, 
and (/(xi), . . . , f{xp), g(yi), . . . ,giyq)) £ R, for given R c Z^^'', where p and q are positive constant inte- 
gers. We call this problem {p,q)-subset finding problem and denote it by {p,q) - subsetfindmg(A'^> ^))- Thus, 
clawfinding(A^, ^) is a special case of (p, ^)-subsetfindmg(A^5^)) with p = q = I and equahty relation R. The 
query complexity is 




{N <M < 
{M > N^), 




Our claw finding algorithm first finds subsets X c X and F c F of size 0(1) such that there is a claw inXxY, 
by using binary and 4-ary searches over X and F; in order to decide which branch we should proceed at each 
visited node in the search trees, we use a subroutine that decides, with one-sided bounded error, whether or not 
there exists a claw of two functions / and g. The algorithm then searches X x F for a claw by making classical 
queries. If we naively repeated the bounded-error subroutine 0(log M) times at each visited node to guarantee 
bounded error as a whole, a "log" factor would be multiplied to the total query complexity. Instead, at the 
node of depth s in the search trees, we repeat the subroutine 0{s) times to amplify success probability. This 
achieves bounded error as a whole, while pushing up the query complexity by just a constant multiplicative 
factor. This binary search technique can be used to solve other problems such as the search version of the 
element distinctness problem, with the quantum walk algorithm for the problems in |[T6l . (H0yer et al. | [T2l 
introduced an error reduction technique with a similar flavor; however, their technique is used in an algorithmic 
context different from ours: their error reduction is performed at each recursion level while ours is sequentially 
used at each step of the search tree.) 

The subroutine is developed around the Szegedy's quantum walk framework |[T6l over a Markov chain on 
the graph categorical product of two Johnson graphs, which correspond to the two functions (with an idea 
similar to the one used in 191). The Johnson graph J{n,k) is a connected regular graph with {"^ vertices 
such that every vertex is a subset of size k of [n]; two vertices are adjacent if and only if the symmetric 
difference of their corresponding subsets has size 2. For two functions / and g with domains X and F such 
that \X\ < |F|, the subroutine applies Szegedy's quantum walk to the graph categorical product of two Johnson 



graphs Jf = /(|X|,(|X||F|)i/3) and 7, = J{\Y\,{\X\\Y\y'') if |F| < \X\\ and Jf = J{\X\,\X\) and Jg = J{\Y\,\X\) 



Our algorithm can be generalized to the /c-claw finding problem. For the k-clsm finding problem 
A:-clawfinding(A'^i5 • ■ • ,Nk) against the k functions with domain sizes Ni (i = 1, . . . , k), repectively, 



Our algorithms can work with slight modification even against a comparison oracle (i.e., against an oracle 
that, for a given pair of inputs (xi, xj) e Xi x Xy, only decides which is the larger of two function values fi{xi) 
and fj{xj)); the query complexity increases by a multiplicative factor of \ogN\ for the /^-function case (\ogN 
for the two-function case). 

Related works 

Recently, Magniez et al. | iT3l developed a new quantum walk over a Markov chain. One of the advantages 
of their quantum walk over Szegedy's quantum walk is that their quantum walk can find a marked vertex if 
there is at least one marked vertex, which would simplify our algorithm. Interestingly, our algorithm shows 
Szegedy's quantum walk together with carefully adjusted binary search can find a solution in some interesting 
problems such as the claw finding problem and the element distinctness problem with the same order of query 
complexity. 

2 Preliminaries 

This section defines problems and introduces some useful techniques. We denote the set of positive integers by 
Z*, the set of {/ \j<i<k for /, j, it € Z*) by [j.k], and [\.k] by [k] for short. 



otherwise. 





otherwise. 



Problem 1 (Claw Finding Problem) Given two fimctions f : X :- [N] Z and g : Y :- [M] Z as an 
oracle for N < M, where Z - [|Z|], find a pair {x,y) e X X Y such that f{x) = g(y) if such a pair exists. 



Actually, Z is allowed to be any totally ordered set, but we adopt the above definition for simplicity. 

In a quantum setting, the two functions are given as quantum oracle Of\g which is defined as Of\g : 
\p,z,w) — > \p,z © P{p) (mod |Z|),w), where p € X U F, z € Z, w is work space, P{p) is defined as f{p) 
ii p e X and g{p) ii p eY (note that it easy to know whether is in X or F by using one more bit to represent 
p). This kind of oracle, which returns the value of the function(s), is called a standard oracle. 

Another type of oracle is called the comparison oracle, which, for given two inputs, only decides which 
is the larger of the two function values corresponding to the inputs. More formally, comparison oracle Of^g is 
defined as Of^g : \p, q, b, w) — > \p, q,b® [P{p) < Q{q)], w), where p,q € X[JY,b e {0, 1), w and P are defined 
as in the standard oracle, Q is defined in the same way as P, and [P(p) < Q{q)] is the predicate such that its 
value is 1 if and only if P{p) < Q{q). 

It is obvious that, if we are given a standard oracle, we can realize a comparison oracle by issuing 0(1) 
queries to the standard oracle. Thus, upper bounds for a comparison oracle are those for a standard oracle, 
and lower bounds for a standard oracle are those for a comparison oracle, if we ignore constant multiplicative 
factors. 

Buhrman et al. (71 generalized the claw finding problem to a ^-function case. 

Problem 2 (^-Claw Finding Problem) Given k functions fi : Xi := [A^,] Z (i € [k]) as an oracle, where 
Ni < Nj ifi < j, and Z :- [|Z|], find a k-claw, i.e., a k-tuple (xi, . . . , x^) e X\X ■ ■ ■ xXk such that fj{xi) - fj{xj) 
for any i, j € [k], if it exists. 

Standard and comparison oracles are defined in almost the same way as in the two-function case, except that 
inputs p and q belong to one of X,'s, respectively, for / e [k]. 

The next theorem describes Szegedy's framework, which we use to prove our upper bounds. 

Theorem 1 (|16J) Let Ai be a symmetric Markov chain with state set V and transition matrix P and let 3m 
be the spectral gap of P, i.e., 1 - max,- \Ai\for the eigenvalues Ai's of P. For a certain subset V' Q V with the 
promise that \V'\ is either or at least e\V\for < e < 1, any element in V' is marked. For T = 0(1/ V^^AlX 
the next quantum algorithm decides whether \V'\is ( "false "} or at least e\ V\ ( "true ") with one-sided bounded 
error with cost 0{Cu + (Cp + Cw)/ V^^), where C = 'Zt |c,-)(c;| for |c;> ^ Y^j ylPij\i)\i) and R = X; \rj){rj\ 
for lo> = ^/PTi\i)\j)- 

1. Prepare |0) in a one-qubit register Rq, and prepare a uniform superposition |0o> := y== jey,p,^^o lOlj) 
in a register Ri with cost at most C(j, where r is the number of adjacent states (of any state) in At. 

2. Apply the Hadamard operator to Rq. 

3. For randomly and uniformly chosen I < t < T, apply the next operation W t times to Ri if the content of 
Rq is "1." 

3.1 To any \i)\j), perform the next steps: (i) Check ifi e V with cost at m^ost Cf, (ii) Ifi ^ V, apply 
diffusion operator 2C - I with cost at most Cw- 

3.2 To any \i)\j), perform the next steps: (i) Check if j e V with cost at most Cf, (ii) If j ^ V, apply 
diffusion operator 2R - I with cost at most Cw- 

4. Apply the Hadamard operator to Rq, and measure registers Rq and Ri with respect to the computational 
basis. 

5. If the result of measuring Rq is lora marked element is found by measuring Ri, output "true "; otherwise 
output "false." 

3 Claw Detection 

In this section, we describe "claw-detection" algorithms that detect the existence of a claw. The claw-detection 
algorithms will be used as subroutines in the "claw-search" algorithms presented in the next section that find a 



claw. 

Before presenting the claw-detection algorithm, we introduce some notions. The Johnson graph J{n, k) is 
a connected regular graph with vertices such that every vertex is a subset of size k of [«] ; two vertices are 
adjacent if and only if the symmetric difference of their corresponding subsets has size 2. The graph categorical 
product G - (Yg, Eg) of two graphs G\ = {Vg, , Egi ) and G2 = {Vg2,Eg2)< denoted by G = Gi x G2, is a graph 
having vertex set Vg = VgiXVg, such that ((vi, V2), (v^, v^) e Eq if and only if (vi, v'^) € Eg, and (v2, Vj) € Eg2- 

The next two propositions are useful in analyzing the claw-detection algorithms we will describe. 

Proposition 2 For Markov chains Ai, vVti , . . . , A\k, the spectral gap 6 of M is the minimum of those 6\,. . . ,5k 
of Ail, . . . ,Aik, i-e., 6 - min,{5,}, if the underlying graph of Ai is the graph categorical product of those of 
Mu...,Mk. 

The eigenvalues of the Markov chain on J{n, k) are ^^~^^k(n-k)''~^ J ^ [O.k] lH pages 255-256], from which 
the next proposition follows. 

Proposition 3 The Markov chain on Johnson graph J{n, k) has spectral gap 6 = ^(j), if 2 < k < n/2. 

We will first describe a claw-detection algorithm against a comparison oracle, from which we can almost 
trivially obtain a claw-detection algorithm against a standard oracle. Let Claw .Detect denote the algorithm. 
To construct Claw .Detect, we apply Theorem [T] on the graph categorical product of two Johnson graphs Jf = 
J{\X\, I) and Jg = J{\Y\, m) for the domains X and Y of functions / and g, respectively, where / and m (l < m) 
are integers fixed later. 

More precisely, let F and G be any vertices of Jf and J^, respectively, i.e., any /-element subset and m- 
element subset of X and Y, respectively. Then (F, G) is a vertex in Jf x Jg. Similarly, for any edges {F, F') and 
{G,G') of Jf and Jg, respectively, {{F,G),{F' ,G')) is an edge connecting two vertices {F,G) and {F',G') in 
Jf X Jg. We next define "marked vertices" as follows. Vertex {F, G) is marked if there is a pair of {x,y) e F xG 
such that f{x) - g{y). To check if {F, G) is marked or not, we just sort all elements in F U G on their function 
values. Although we have to sort all elements in the initial vertex, we have only to change a small part of 
the sorted list we have already had when moving to an adjacent vertex. For every vertex {F, G), we maintain a 
representation Lf G of the sorted list of all elements in FuG on their function values, and we identify {F, G, Lf,g) 
as a vertex of Jf x Jg. Here, we want to guarantee that Lp^G is uniquely determined for any pair {F, G) in order 
to avoid undesirable quantum interference; we have just to introduce some appropriate rules that break ties, i.e., 
the situation where there are multiple elements in F U G that have the same function value. 

As the state |0o) in Theorem [U we prepare 

\M= ^ \F,G,Lp^G)\F',G',Lp,^G'), 

J(^M"]KN - l)m{M - m) i/^Af'i=iGAG'i=2 

y\ij\mj f f/cx|F|=|/7'|=/ 

G,G'QY,\G\=\G'\=m 

in register Ri . The number 1 < f < of repeating W is chosen randomly and uniformly for some constant c, 
6 ■.= Q.{\lm)!mde:=lml{NM). 

We next describe the implementation of operation W. Since diffusion operator 2C - I depends on Lpg's, 
it cannot be performed without queries to the oracle. We thus divide operator 2C - I into a few steps. For 
every unmarked vertex (F,G,Lpg), we first transform \F,G,Lf^g)W ^G' ,Lp'^G') into \F,G,Lpg)\F',G',Lpg} 
with queries to the oracle. We then perform a diffusion operator on the registers where the contents "f , G" 
and "F',G"' are stored, to obtain a superposition of \F,G,LFfi)\F" ,G",LpG} over all {F",G") adjacent to 
(F,G). Finally, we transform \F,G,Lf,g)\F" ,G" ,Lf,g) into \F,G,Lf,g)\F" ,G" ,Lf",g")- Operator 2R - I can 
be implemented in a similar way. 



Lemma 4 Let 22(claWdetect(A'^> M)) be the number of queries needed to decide whether there is a claw or not 
for functions f : X := [N] Z and g : Y := [M] Z given as a comparison oracle. Then, 



e2(claWdetect(A^, M)) = 



(OiiNMy^ log A^) {N<M < N^) 



Proof We will estimate Cu, Cf and Cw for ClawJDetect, and then apply Theoiem[T] 

To generate |0o), we first prepare the uniform superposition of \F,G)\F' ,G') over all F,F',G,G' such 

that iF,F') and {G,G') are edges of Jf and Jg, respectively. Obviously, this requires no queries. We then 

compute Lf Q and Lp Qi for each basis state by issuing 0{{l + m)log(Z + m)) queries to oracle Of^g. Thus, 

Cu = 0{{l + m) log(Z + m)). 

We can check if there is a pair of {x,y) e F x G such that f{x) = g(y) by looking through Lpc (without any 

queries). Thus, Cf = 0. 

For every unmarked {F, G, Lfc), step (a).ii of operation W transforms \F, G, LfG}\F', G', Lf^c') into a su- 
perposition over all \F,G,Lf^g)\F" ,G" ,Lf'\g") such that \F/\F"\ = \GaG"\ = 2. This is realized by insertion 
and deletion of 0(1) elements to/from the sorted list of 0(1 + m) elements, and diffusion operators without 
queries. Each insertion or deletion can be performed with C?(log(/ + m)) queries by using binary search. Simi- 
larly, step (b).ii of operation W needs C?(log(/ -i- m)) queries. Thus, we have Cw - 0(log(/ -i- m)). 

We set e to ^ X since the probability that a state is marked is minimized when only one claw exists 
for / and g, in which case the probability is ^ x ^. Since, from Proposition [3l the spectral gaps of the 
Markov chains on J{N,l) and J{M,m) are Q(j) and respectively, the spectral gap of the Markov chain 

on JiN, I) X J{M, m) is a(min| j, ^)) = n(^) due to / < m and Proposition El 

From Theorem [TJ the total number of queries is 22(claWdetect(A^> ^)) = 0{{l + m)log(/ + m) + log(/ -i- 
m) y/miNM/ilm))) = 0((l + m) log(Z + m) + ^fNMTl^ogil + m)). 

When N < M < N^, we set I = m = &{(NMy^^), which satisfies condition / < A'^. The total number 
of queries is G2(clawdetect(A^, ^)) - 0((A^M)'''^ log A^). When M > N^, we set I - m - N, implying that 
e2(clawdetect(A^, M)) = 0{M^I^ log A^). □ □ 



The standard oracle case can be handled by using almost the same approach. 

Corollary 5 Let 22(claWdetect(A'^> M)) the number of queries needed to decide whether there is a claw or not 
for functions f : X = [N] Z and g : Y = [M] — > Z given as a standard oracle. Then, 

(OiiNMy^) {N<M< N^) 

e2(claWdetect(A^, M)) = \ 



The claw-detection algorithm against a standard oracle can easily be modified in order to solve the more general 
problem of detecting a tuple (xi, . . . , Xp,yi, . . . ,yq) e X^ x Y'^ such that Xi + Xj and yi yj for any / j, and 
(f(xi), . ■ . ,fixp),g(yi), . . ■,g(yq)) £ R, for given 7? c ZP'^'^, where p and q are any constant positive integers. 
A modification is made to the part of the algorithm that decides whether a vertex of the underlying graph is 
marked or not; the modification can be made without changing the number of queries. The query complexity 
can be analyzed by using almost the same approach as used in claw detection with e = (^J^ ) /(^) x (^1^) /(^) > 
Fm^il - o{\))l{NPM'i); the query complexity is C>((A^pM«)1/<p+'?+'^) for A^ < M < N^^^'"' and OiM'^'^^^'^^) for 
M > N^'''^^''. The problem of finding such a tuple can also be solved with the same order of complexity as 
above by using the algorithm for detecting it as a subroutine. 

Our algorithm for detecting a claw can easily be generalized to the case of k functions of domains of size 
Ni,. . . ,Nk, respectively. More concretely, we apply Theorem [U to the Markov chain on the graph categorical 



product of the k Johnson graphs, each of which corresponds to one of the k functions. We denote this "^-claw 
detection" algorithm by fc-Claw .Detect in the next section. 



Lemma 6 For any positive integer k > \, let 22(k-claWdetect(A'^i, ■ ■ • ,Nk)) be the number of queries needed to 
decide whether there is a k-claw or not for functions f : Xi := [Ni] Z {i e [k]) given as a comparison oracle, 
where Nj < Nj if i < j.Ifk is constant, 



Proof (Sketch). In a way similar to the case of two functions, we apply Theorem[T]on the graph categorical 
product of k Johnson graphs Jf. := (/ € [k]) for the domains X,'s of functions f's, where Z;'s are 

integers fixed later such that < Ij for / < / 

To generate l^o)^ we first prepare the uniform superposition of |Fi, . . . , Fyt)|Fj, . . . , over all Fj and F. 
such that (Fi, F'.) is an edge of Jf. for every /. This requires no queries. As in the case of two functions, define 
LFi,...,Fk for ^riy Fi, . . . ,Fk as a representation of the sorted list of all elements in IJ^^^ F,- so that it can be 
uniquely determined for each tuple (Fi, . . . , F^). We then compute Lf , and Lf^ f^ for each basis state by 

issuing + • • • + Z;t)log(/i H + 4)) queries to the oracle. Thus, Cu = 0{{h -i + 4)log(/i H + h))- 

Cf and Cw can be estimated as and O (log(/i + • • • + 1^)), respectively, in a way similar to the case of two 
functions. We set e to 0/-! h/Nj and 6 to min;{ 1 //,} = 1 /4- 

When nf=2 = 0{N\), we set := |(n?=i A^/)^ j for every / € [k\, which satisfies condition < A^i < 

A^; for every / € [/:]. When 0^=2 A^' - ^(A'^f)' we set /, := ©(A'^i) for every / € [k]. □ Against a standard oracle, 

we obtain a similar result. 

Corollary 7 For any positive integer k > \, let 22(k-claWdetect(A'^i> ■ ■ ■ ■,Nky) be the number of queries needed 
to decide whether there is a k-claw or not for functions f : Xi := [A^,] Z (i e [k]) given as a standard oracle, 
where Ni < Nj ifi < j. Ifk is constant, 



4 Claw Finding 

We now describe an algorithm. Claw .Search, that finds a claw. The algorithm consists of three stages. In the 
first stage, we find an C?(A'^)-sized subset Y' of Y such that there is a claw in Xx 7', by performing binary search 
over Y with Claw JDetect. In the second stage, we perform 4-ary search over X and Y' with Claw .Detect to find 
0(l)-sized subsets X" and Y" of X and Y', respectively, such that there is a claw in X" x Y". In the final stage, 
we search X" x Y" for a claw by issuing classical queries. To keep the error rate moderate, say, at most 1/3, 
Claw JDetect is repeated 0{s) times against the same pair of domains at the sth node of the search tree at each 
stage. This pushes up the query complexity by only a constant multiplicative factor. 

Figure [Uprecisely describes Claw .Search. Steps 2, 3 and 4 in the figure correspond to the first, second and 
final stages, respectively. 





Algorithm Claw_Search 

Input: Integers M and N such that M > N; Comparison oracle O f\g for functions f : X ^ Z and g : Y ^ Z, 
respectively, such that X := [N] and Y := [M]. 

Output: Claw pair {x,y) e X x Y such that f{x) = g{y) if such a pair exists; otherwise (-1, -1). 

1. Setl:=Xandy := Y. 

2. Set s := 1, and repeat the next steps until Uf - If ^ \X\, where Uf and If are the largest and smallest 
values, respectively, in Y. 

2.1 Set Ey := {[/y.my - 1], [mf.Uf]}, where mf := 1(1 f + My)/21. 

2.2 For every Y' € Hy, do the following. 

If all Y' € Hy are examined, output (-1, -1) and halt. 

2.2.1 Apply ClawJDetect (s + 2) times to / and g restricted to domains X and Y, respectively. 

2.2.2 If at least one of the (s + 2) results is "true," set Y := Y', and break (leave (b)). 

2.3 Sets ■- s+\. 

3. Set 5 := 1, and repeat the next steps until ud-Id ^ c for every D € [X, Y} and some constant c, say, 100, 
where ujj and Ijj are the largest and smallest values, respectively, in D. 

3.1 For every D € [X, Y], set Ed '■= {Ud-Ud]} if ud-Id < c, and 
otherwise, set Ed :- {{iD-niD - 1], \mD-UDVi where tud '■- \{Id + md)/21. 

3.2 For every pair {X' , Y') eEi^x Hy, do the following. 
If all the pairs are examined, output (-1,-1) and halt. 

3.2.1 Apply ClawJDetect {s + 3) times to / and g restricted to domains X' and Y' , respectively. 

3.2.2 If at least one of the {s + 3) results is "true," set X :- X' and Y := Y' , and break (leave (b)). 

3.3 Set 5 :^ 5+ 1. 

4. Classically search X x F for a claw. 

5. Output claw {x,y) eXxY if it exists; otherwise output (-1, -1). 

Figure 1 : Algorithm Claw .Search 

Theorem 8 Let 22(claWfinding(A^> ^)) be the number of queries needed to locate a claw if it exists for functions 
f : X = [N] Z and g : Y - [M] Z given as a comparison oracle. Then, 



Proof We will analyze Claw .Search in Fig.[T] 

When there is no claw. Claw .Search always outputs the correct answer. Suppose that there is a claw. The 
algorithm may output a wrong answer if at least one of the following two cases happens. In case (1), one of 
0(log M/N) runs of step 2.(b) errs; in case (2), one of 0{logN) runs of step 3.(b) errs. 

Without loss of generality, the error probability of ClawJDetect can be assumed to be at most 1/3. The error 
probability of each single run of step 2.(b).i is at most -p^. The error probability of each run of step 2.(b) is 

at most < The error probability of case (1) is thus at most Xv=f < 5- The error probability 

of case (2) is also at most 5 similar calculation. Therefore, the overall error probability is at 

most 1/6+1/6=1/3. 




We next estimate the number of queries. If A'^ < M < N"^, the size of Y is always at most quadratically 
different from that of X. Thus, the 5th repetition of step 2 requires 0{s{NM 12^)^1^ ^ogN) queries by LemmalU 
Similarly, the ^th repetition of step 3 requires 0{s{N/2^)^^^ log A^) queries by LemmaSl 

The total number of queries is 



fllogiM/N)-] 



o 



y MA^:r^ logA^ + 2 {siN/rf'HogN) ^ O {(NM)'" log n) . 



If M > N^, the sth repetition of step 2 requires 0{s{{NMI2'fl^ + (M/2'')'''^)logA^) by LemmaH Thus, 
similar calculation gives 0{M^I^ logN) queries. □ □ 



We can easily obtain the standard-oracle version of the above theorem by using Corollary [5]instead of LemmalU 



Corollary 9 Let 22(claWfinding(A^> ^)) be the number of queries needed to locate a claw if it exists for functions 
f : X :- [N] Z and g : Y := [M] Z given as a standard oracle. Then, 

Similarly, we can find a ^-claw by using ^-Claw JDetect as a subroutine. First, we find 0(A^i)-sized subset X. of 
Xi for every / e [2.k] such that there is a fc-claw inXi xX'^x ■ ■ ■ x X'^, by performing 2'^~^-ary search over Xj's 
for all / € {2.1c\ with /:-ClawJDetect. Let X[ := Xi. We then perform 2*-ary search over X'.?, for all / € [k\ with 
/c-Claw .Detect to find 0(l)-sized subset X" of X'. for every / € [k\ such that there is a /c-claw in X" x • • • x X['. 
Finally, we search X" x • • • x X^' for a ^-claw by issuing classical queries. A more precise description of the 
algorithm, /:-Claw .Search, is given in Fig.|2l 

Theorem 10 For any positive integer k> \, let 22(k-claWfinding(A'^i. ■ ■ ■ > Nk)) be the number of queries needed 
to locate a k-claw if it exists for k functions f : X,- := [A^,] Z {i e [k]) given as a comparison oracle, where 
Ni < Nj ifi < j. Ifk is constant. 



e2(k-clawfinding(A^i, • • ' ,Nk)) 



O ( ^Y\\=2^ilN\-'^ log A^i ) otherwise. 
We can easily obtain the standard-oracle version of the above theorem by using Corollary |7]instead of Lemma|6] 



Corollary 11 For any positive integer k> \, let 22(k-claW(inding(A'^i , • ■ • , Nk)) be the number of queries needed 
to locate a k-claw if it exists for k functions f : X,- := [A^,] Z (i e [k]) given as a standard oracle, where 
Ni < Nj ifi <j.Ifk is constant. 



e2(k-claWjinding(A^i,--- , Nk)) 



oiinLNiY 



if nl2^i - OiN^), 



O ( ^11^2 ^'-/A^f"^) otherwise. 
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Algorithm A:-Claw_Search 

Input: k integers N\,...,Nk such that A^,- < Nj if / < j. 

Comparison oracle Of^^,„j^ for functions fi : X,- ^ Z such that X,- := \Ni\ for every / e \k\. 

Output: ^-claw {x\, . . . , Xk) ^ X\ x ■ ■ ■ x such that fi{xi) - fj{xj) for every i, j e [k\ if it exists; otherwise 

1. Set Xi :- Xi for every / e [k]. 

2. Set 5:^1, and repeat the next steps until m,- - /, < \Xi\ for all i e [2.k], where m,- and /,• are the largest and 
smallest values, respectively, in Xi. 

2.1 For every / e [2.k], set H, := {[/,-.«;]} if m,- - < \Xi\, and 
otherwise, set E,- := {[//.m; - 1], [m;.M,]) where m,- := + m;)/2]. 

2.2 For every tuple (Xj,X2, . . . e {Xi} x H2 x • • • X Ek, do the following. 
If all the tuples are examined, output (-1, . . . , -1) and halt. 

2.2.1 Apply A:-Claw_Detect + 1) + riog3 2*^"^] times to the k functions fi restricted to domains X'^, 
respectively, for every i e [k]. 

2.2.2 If at least one of the (j + 1) + flogs results is "true," set X,- := it', for every i e [2.k], and 
break (leave (b)). 

2.3 Set* := s + I. 

3. Set .V := 1, and repeat the next steps until m, - /; < c for all / e [k] and some constant c, say, 100, where 
Ui and are the largest and smallest values, respectively, in Z,. 

3.1 For every / e [k], set S,- := {[/,-. m;]) if m; - < c, and 
otherwise, set E,- := {[k.mi - 1], where m,- = [(/,• + m,)/2]. 

3.2 For every tuple (X[, X'^, . . . , X'^^) € Ei x • • • x E/,, do the following. 
If all the tuples are examined, output (-1, . . . , -1) and halt. 

3.2.1 Apply A^-Claw_Detect + 1) + flogs ^^^l times to the k functions restricted to domains X'. for 
every i e [k]. 

3.2.2 If at least one of the + 1) + flogs ^^l results is "true," set Xi :- X'^ for every i e [k], and break 
(leave (b)). 

3.3 Set* := * + 1. 

4. Classically search Xi x ■ ■ ■ xXj^foi a A:-claw. 

5. Output A:-claw (xi, . . . ,Xk) e X[x ■ ■ ■ xX'j^if it exists; otherwise output (-1, . . . , -1). 



Figure 2: Algorithm A:-Claw .Search 



